Last Man Standing
First Flight #45
Beginner FriendlyFoundrySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

[L-1] Misleading GameEnded Event Emitted After pot is Zeroed

wolf_kalp

[L-1] Misleading GameEnded Event Emitted After pot is Zeroed

Description

The declareWinner() function emits the GameEnded event after setting pot = 0, resulting in prizeAmount always being emitted as 0, even though the winner's actual reward was non-zero.

This behavior misleads off-chain systems, dashboards, users, or auditors who rely on event data for historical game outcomes.

Impact:

1.Users/frontends will see a prize amount of 0 in the GameEnded event, even if the actual winnings were much higher.

2.Analytics tools or dashboards built on event logs (e.g., The Graph, Dune, Nansen) will display incorrect prize history.

3.Trust in contract transparency may be undermined due to inaccurate emitted data.

Proof of Concept

In the declareWinner() function:

pendingWinnings[currentKing] += pot;
pot = 0;
emit GameEnded(currentKing, pot, block.timestamp, gameRound); // `pot` is already 0
​
emit GameEnded(winner, 0, timestamp, round); // always shows 0 prize
​

Recommended Mitigation

Cache the pot value in a local variable before zeroing it, and use the cached value in the event:

uint256 reward = pot;
pendingWinnings[currentKing] += reward;
pot = 0;
​
emit GameEnded(currentKing, reward, block.timestamp, gameRound);
Updates

Appeal created

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Game::declareWinner emits GameEnded event with pot = 0 always

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!